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We claim: 

1 . A method of monitoring the behavior of a protocol contained within a network 
frame having at least one protocol data unit, containing at least one field, comprising: 

receiving a set of network frames from a network; 

filtering a one of the set of network frames for monitoring, the one of the 
set of network frames having at least one protocol data unit; 

retrieving protocol knowledge of the data structure of the at least one 
protocol data unit enabling the extraction of the at least one field; 

extracting a value from the at least one field of the at least one protocol 
data unit; and 

updating protocol status on a user interface with the value. 

2. The method of claim 1 wherein the protocol status is the current state and 
configuration of the protocol. 

3. A method of monitoring the behavior of a protocol contained within a network 
frame having at least one protocol data unit, containing at least one field, comprising: 

receiving a set of network frames from a network; 

filtering a one of the set of network frames for monitoring, the one of the- 
set of network frames having at least one protocol data unit; 

retrieving protocol knowledge of the data structure of the at least one 
protocol data unit enabling the extraction of the at least one field; 
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extracting a value from the at least one field of the at least one protocol 
data unit; and 

updating protocol events on a user interface with the value. 

4. The method of claim 3 wherein the protocol events record the time and type 
of the event. 

5. The method of claim 3 wherein the protocol events record the time of the 
event, type of the event, and message type response of the event. 

6. Apparatus for monitoring the behavior of a protocol contained within a 
network frame having at least one protocol data unit, containing at least one field, the 
apparatus comprising: 

a user interface for displaying protocol status and event updates; 
a network connection; 

a protocol decoder for extracting a value from a protocol data unit of a 
network frame and associating the value with a keyword; and 

a protocol monitor connected to the user interface and the network 
connection for receiving a network frame and updating protocol status and 
protocol events on the user interface based on the value. 

7. The apparatus of claim 6 wherein the protocol status record the time and 
type of the event. 
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8. The apparatus of claim 6 wherein the protocol events record the time of the 
event, type of the event, and message type response of the event. 

9. The apparatus of claim 8 operable as a network analyzer. 

10. Apparatus for monitoring the behavior of a protocol contained within a 
network frame having at least one protocol data unit, containing at least one field, 
comprising: 

means for receiving a set of network frames from a network; 

means for filtering a one of the set of network frames for monitoring, the 
one of the set of network frames having at least one protocol data unit; 

means for retrieving protocol knowledge of the data structure of the at 
least one protocol data unit enabling the extraction of the at least one field; 

means for extracting a value from the at least one field of the at least one 
protocol data unit; and 

means for updating protocol status on a user interface with the value. 

1 1 . The apparatus of claim 10 wherein the protocol status is the current state 
and configuration of the protocol. 
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12. Apparatus for monitoring the behavior of a protocol contained within a 
network frame having at least one protocol data unit, containing at least one field, 
comprising: 

receiving a set of network frames from a network; 

filtering a one of the set of network frames for monitoring, the one of the 
set of network frames having at least one protocol data unit; 

retrieving protocol knowledge of the data structure of the at least one 
protocol data unit enabling the extraction of the at least one field; 

extracting a value from the at least one field of the at least one protocol 
data unit; and 

updating protocol events on a user interface with the value. 

13. The apparatus of claim 12 wherein the protocol events record the time and 
type of the event. 

14. The apparatus of claim 12 wherein the protocol events record the time of 
the event, type of the event, and message type response of the event. 

15. A computer-readable medium whose contents cause a computer system to 
monitor the behavior of a protocol contained within a network frame having at least 
one protocol data unit, by a method comprising: 

receiving a set of network frames from a network; 
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filtering a one of the set of network frames for monitoring, the one of the 
set of network frames having at least one protocol data unit; 

retrieving protocol knowledge of the data structure of the at least one 
protocol data unit enabling the extraction of the at least one field; 

extracting a value from the at least one field of the at least one protocol 
data unit; and 

updating protocol status on a user interface with the value. 

17. The computer-readable medium of claim 16 wherein the protocol status is 
the current state and configuration of the protocol. 



18. A computer-readable medium of monitoring the behavior of a protocol 
contained within a network frame having at least one protocol data unit, containing at 
least one field, comprising: 

receiving a set of network frames from a network; 

filtering a one of the set of network frames for monitoring, the one of the 
set of network frames having at least one protocol data unit; 

retrieving protocol knowledge of the data structure of the at least one 
protocol data unit enabling the extraction of the at least one field; 

extracting a value from the at least one field of the at least one protocol 
data unit; and 

updating protocol events on a user interface with the value. 
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19. The computer-readable medium of claim 18 wherein the protocol events 
record the time and type of the event. 

20. The computer-readable medium of claim 18 wherein the protocol events 
record the time of the event, type of the event, and message type response of the 
event. 
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